Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
- Posted on September 25, 2026
- By The Hacker News
- 1 Views
- 1 min read
In brief
GitHub has taken action against compromised Actions that were reactivated and continued distributing Mini Shai-Hulud malware. The threat actors exploited re-enabled repositories to execute credential-stealing attacks through malicious May 18 tags. This security incident highlights the ongoing risks of supply chain attacks targeting development platforms and the importance of monitoring repository activity for suspicious behavior patterns.
Summary auto-generated by AI from the original publisher's content. Editorial standards.
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
GitHub disabled two actions-cool Actions again after re-enabled repositories left malicious May 18 tags able to execute credential-stealing code.
